From a2aed869944b88ec12fc555d471b078d9a82d7b0 Mon Sep 17 00:00:00 2001 From: Yuriy Andamasov Date: Sun, 5 Jul 2026 23:52:16 +0300 Subject: docs: T8887: backfill Phase 1 commands from recent vyos-1x additions MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Documents six CLI features added to vyos-1x between Nov 2025 and May 2026 that were missing from the docs (gap-audit T8886, Phase 1 / T8887): - policy route-map match source-peer (vyos-1x#5149, T8588) - high-availability vrrp snmp trap (vyos-1x#5108, T8448) - protocols segment-routing traffic-engineering subtree (vyos-1x#4994, T6750) - protocols bgp bmp target monitor pre-policy/post-policy/local-rib (vyos-1x#4922, T8133) - firewall global-options geoip provider/maxmind-* (vyos-1x#4949, T7926/T8049) - vpn ipsec childless IKE SA option (vyos-1x#4930, T8136) system frr watchfrr-timeout and service router-advert prefix base-interface are now documented on rolling via the page rewrites in vyos-documentation#2251 and vyos-documentation#2132. protocols bgp parameters as-notation is deferred: rolling carries it commented out; to be handled in a follow-up. 🤖 Generated by [robots](https://vyos.io) --- docs/configuration/firewall/global-options.md | 26 ++++++++++++ docs/configuration/highavailability/index.md | 8 ++++ docs/configuration/policy/route-map.md | 7 ++++ docs/configuration/protocols/bgp.md | 25 ++++++++++++ docs/configuration/protocols/segment-routing.md | 53 +++++++++++++++++++++++++ docs/configuration/vpn/ipsec/ipsec_general.md | 21 ++++++++++ 6 files changed, 140 insertions(+) diff --git a/docs/configuration/firewall/global-options.md b/docs/configuration/firewall/global-options.md index 0f6d91ac..fae0bf7e 100644 --- a/docs/configuration/firewall/global-options.md +++ b/docs/configuration/firewall/global-options.md @@ -119,6 +119,32 @@ The following sysctl parameter will be changed: * ``net.ipv4.tcp_rfc1337`` ``` +## GeoIP + +```{cfgcmd} set firewall global-options geoip provider + +Select the GeoIP database provider used to resolve country codes +for firewall GeoIP matching. `db-ip` uses the DB-IP.com database and requires +no credentials; `maxmind` uses the MaxMind database and requires a MaxMind +account ID and license key. The default is `db-ip`. +``` + +```{cfgcmd} set firewall global-options geoip maxmind-account-id + +Account ID for the MaxMind GeoIP database. +``` + +```{cfgcmd} set firewall global-options geoip maxmind-license-key + +License key for the MaxMind GeoIP database. +``` + +```{cfgcmd} set firewall global-options geoip maxmind-lite + +Use the free MaxMind GeoLite2 database instead of the paid +GeoIP2 database. +``` + ```{cfgcmd} set firewall global-options state-policy established action [accept | drop | reject] ``` diff --git a/docs/configuration/highavailability/index.md b/docs/configuration/highavailability/index.md index 1e4f2aed..4c017b76 100644 --- a/docs/configuration/highavailability/index.md +++ b/docs/configuration/highavailability/index.md @@ -317,6 +317,14 @@ need to configure it. But if necessary, Gratuitous ARP can be configured in will always use version 3. ``` +## SNMP traps + +```{eval-rst} +.. cfgcmd:: set high-availability vrrp snmp trap + + Enable sending SNMP traps from keepalived on VRRP state changes. +``` + ## Scripting VRRP functionality can be extended with scripts. VyOS supports two kinds of diff --git a/docs/configuration/policy/route-map.md b/docs/configuration/policy/route-map.md index cf419a48..1d49dfe3 100644 --- a/docs/configuration/policy/route-map.md +++ b/docs/configuration/policy/route-map.md @@ -219,6 +219,13 @@ Match RPKI validation result. ``` +```{cfgcmd} set policy route-map \ rule \<1-65535\> match source-peer \ + +BGP source peer to match. The value can be a peer IPv4 address, a peer IPv6 +address, an interface name of a peer, or a BGP peer-group name. +``` + + ```{cfgcmd} set policy route-map \ rule \<1-65535\> match source-vrf \ Source VRF to match. diff --git a/docs/configuration/protocols/bgp.md b/docs/configuration/protocols/bgp.md index d7310ba2..46b2df99 100644 --- a/docs/configuration/protocols/bgp.md +++ b/docs/configuration/protocols/bgp.md @@ -2558,6 +2558,31 @@ set protocols bgp parameters confederation peers 65002 set protocols bgp parameters confederation peers 65003 ``` +### BGP Monitoring Protocol (BMP) configuration + +{abbr}`BMP (BGP Monitoring Protocol)` sends BGP route information to a +monitoring station. BMP support must first be enabled in the routing +daemon with `set system frr bmp`. + +```{cfgcmd} set protocols bgp bmp target \ monitor \ \ + +**Configure which route views are sent to the BMP target for the +specified address family.** + +- `pre-policy`: Send state before policy and filter processing. +- `post-policy`: Send state with policy and filters applied. +- `local-rib`: Send routes from the local RIB. + +Each view is configured separately. Issue the command once per view to +send more than one. +``` + +Example: + +```none +set protocols bgp bmp target collector monitor ipv4-unicast post-policy +``` + ## Operation ### Show diff --git a/docs/configuration/protocols/segment-routing.md b/docs/configuration/protocols/segment-routing.md index b0896f73..fccb2f40 100644 --- a/docs/configuration/protocols/segment-routing.md +++ b/docs/configuration/protocols/segment-routing.md @@ -356,6 +356,59 @@ set protocols ospf segment-routing prefix 192.0.2.1/32 index no-php-flag For more information, see {ref}`ospf`. ``` +## SR-TE configuration + +{abbr}`SR-TE (Segment Routing Traffic Engineering)` steers traffic along an +explicit segment-routed path instead of the IGP shortest path. The initial +SR-TE implementation in VyOS lets you select the IGP that feeds the +{abbr}`TED (Traffic Engineering Database)` and define named segment lists — +ordered label or {abbr}`NAI (Node or Adjacency Identifier)` stacks describing +the path. + +```{cfgcmd} set protocols segment-routing traffic-engineering database-import-protocol \ + +Select the IGP whose originated Traffic Engineering (TE) database is imported +into the TED. +``` + +```{cfgcmd} set protocols segment-routing traffic-engineering segment-list \ + +Define a named segment list. Each entry of the list is addressed by an index +and describes one segment of the path. +``` + +```{cfgcmd} set protocols segment-routing traffic-engineering segment-list \ index \ mpls label \<16-1048575\> + +Set an MPLS label value for the given segment list index. +``` + +```{cfgcmd} set protocols segment-routing traffic-engineering segment-list \ index \ nai adjacency \ source-identifier \ + +Set the adjacency source address identifier (IPv4 or IPv6) for the given +segment list index. +``` + +```{cfgcmd} set protocols segment-routing traffic-engineering segment-list \ index \ nai adjacency \ destination-identifier \ + +Set the adjacency destination address identifier (IPv4 or IPv6) for the given +segment list index. +``` + +```{cfgcmd} set protocols segment-routing traffic-engineering segment-list \ index \ nai prefix \ prefix-identifier \ + +Set an IGP prefix identifier (IPv4 or IPv6 prefix) for the given segment list +index. +``` + +```{cfgcmd} set protocols segment-routing traffic-engineering segment-list \ index \ nai prefix \ prefix-identifier \ algorithm \ + +Select the IGP prefix algorithm style for the prefix identifier: + +- `spf`: Shortest Path First (SPF). +- `strict-spf`: Strict SPF - ignore any possible local policy overriding the + SPF along the path. +``` + ## Examples ### Enable SR on IS-IS (experimental) diff --git a/docs/configuration/vpn/ipsec/ipsec_general.md b/docs/configuration/vpn/ipsec/ipsec_general.md index 62fcec8a..0a79601f 100644 --- a/docs/configuration/vpn/ipsec/ipsec_general.md +++ b/docs/configuration/vpn/ipsec/ipsec_general.md @@ -149,6 +149,27 @@ Possible values of the `configured` field are `none` if not configured, `opt` if configured but optional, and `req` is configured and required. The in use will show yes +## Childless IKE SA + +```{cfgcmd} set vpn ipsec site-to-site peer childless + +Control childless IKEv2 SA initiation ({rfc}`6023` — an IKE SA established +without a Child SA). This option applies to IKEv2 only: + +- `allow`: accept childless IKE SA in responder mode; create a regular IKE SA + in initiator mode. +- `prefer`: accept and create childless IKE SA in both responder and + initiator modes. +- `force`: require the use of childless IKE SA in both responder and + initiator modes. +- `never`: disable support for childless IKE SA when acting as a responder. +``` + +```{cfgcmd} set vpn ipsec remote-access connection childless + +The same option for IKEv2 remote-access connections. +``` + ## Configuration IKE ```{eval-rst} -- cgit v1.2.3